Swiss autism-support foundation Stiftung Autismuslink confirms data-theft cyberattack; INC Ransom claims it

Stiftung Autismuslink (a Bern-based foundation providing school, coaching and vocational-integration services to adolescents and young adults with autism) published a signed victim notice confirming a cyberattack: "Ende Juni wurde unsere IT-Infrastruktur Opfer eines Cyberangriffs. Nach aktueller Erkenntnis wurden grössere Datenmengen durch die Angreifer abgezogen und unser Server vorübergehend verschlüsselt" (end of June our IT infrastructure fell victim to a cyberattack; larger volumes of data were exfiltrated and our server temporarily encrypted) (Stiftung Autismuslink, 2026-07). The foundation states the irregularity was detected Monday 2026-06-29, the system was immediately isolated from the internet, an external IT provider (Infoguard) was engaged for forensics the same day, the relevant authorities were notified and a criminal complaint filed with the police. Backups were verified unaffected. The INC Ransom (Incransom) double-extortion group posted a leak-site claim against autismuslink.ch on 2026-07-24 consistent in victim identity and timeline (Ransomware.live, 2026-07-24), a relatively rare case of same-day victim self-disclosure and leak-site claim converging.

The disclosure event (site notice plus leak-site claim) is what falls in this window; the underlying intrusion dates to late June. What makes it relevant beyond a single victim is the data class: per the foundation, affected material includes service agreements with the Swiss disability insurance (IV) and a cantonal education/culture directorate (BKD), teacher contracts, doctors' certificates and the complete client dossier archive 2016-2023 for minors and young adults.